CVE-2026-66373

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-66373", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-07-25T00:08:35.560Z", "datePublished": "2026-07-25T00:08:35.982Z", "dateUpdated": "2026-08-07T00:01:51.054Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Redis", "vendor": "Redis", "versions": [{"lessThan": "8.8.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-415", "description": "CWE-415 Double Free", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-07-25T00:08:35.982Z"}, "references": [{"url": "https://github.com/redis/redis/pull/15081"}, {"url": "https://github.com/redis/redis/compare/8.6.4...8.8.0"}, {"url": "https://x.com/Fried_rice/status/2080059356322918777"}, {"url": "https://github.com/berabuddies/redis-poc"}, {"url": "https://news.ycombinator.com/item?id=49024938"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*", "versionEndExcluding": "8.8.0"}]}]}]}, "adp": [{"references": [{"url": "https://github.com/berabuddies/redis-poc", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-27T00:00:00+00:00", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-66373"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-28T03:55:42.278Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2026/08/msg00012.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-08-07T00:01:51.054Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2026/08/msg00012.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-08-07T00:01:51.054Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-66373", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-27T13:16:06.628063Z"}}}], "references": [{"url": "https://github.com/berabuddies/redis-poc", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-27T13:16:01.459Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Redis", "product": "Redis", "versions": [{"status": "affected", "version": "0", "lessThan": "8.8.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/redis/redis/pull/15081"}, {"url": "https://github.com/redis/redis/compare/8.6.4...8.8.0"}, {"url": "https://x.com/Fried_rice/status/2080059356322918777"}, {"url": "https://github.com/berabuddies/redis-poc"}, {"url": "https://news.ycombinator.com/item?id=49024938"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-415", "description": "CWE-415 Double Free"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "8.8.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-07-25T00:08:35.982Z"}}}, "cveMetadata": {"cveId": "CVE-2026-66373", "state": "PUBLISHED", "dateUpdated": "2026-08-07T00:01:51.054Z", "dateReserved": "2026-07-25T00:08:35.560Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-07-25T00:08:35.982Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Redis", "vendor": "Redis", "versions": [{"lessThan": "8.8.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243."}], "id": "CVE-2026-66373", "lastModified": "2026-09-09T16:03:33.283", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "cve@mitre.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-66373", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-27T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-07-25T01:16:26.277", "references": [{"source": "cve@mitre.org", "url": "https://github.com/berabuddies/redis-poc"}, {"source": "cve@mitre.org", "url": "https://github.com/redis/redis/compare/8.6.4...8.8.0"}, {"source": "cve@mitre.org", "url": "https://github.com/redis/redis/pull/15081"}, {"source": "cve@mitre.org", "url": "https://news.ycombinator.com/item?id=49024938"}, {"source": "cve@mitre.org", "url": "https://x.com/Fried_rice/status/2080059356322918777"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2026/08/msg00012.html"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/berabuddies/redis-poc"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-415"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{"bugzilla": {"description": "redis: Redis: Remote Code Execution via specially crafted RESTORE payload", "id": "2506985", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506985"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-1341", "details": ["Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.", "A flaw was found in Redis. An authenticated attacker, in an unusual configuration where they can execute the RESTORE command, could exploit a double free vulnerability. This occurs when a specially crafted RESTORE payload references the same NACK (pending entry) by multiple consumers, and both consumers are subsequently deleted via XGROUP DELCONSUMER. Successful exploitation of this flaw could lead to remote code execution."], "name": "CVE-2026-66373", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "impact": "important", "package_name": "boost", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "impact": "important", "package_name": "valkey", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-07-25T00:08:35Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-66373\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-66373\nhttps://github.com/berabuddies/redis-poc\nhttps://github.com/redis/redis/compare/8.6.4...8.8.0\nhttps://github.com/redis/redis/pull/15081\nhttps://news.ycombinator.com/item?id=49024938\nhttps://x.com/Fried_rice/status/2080059356322918777"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,8.8.0)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Redis", "source": "cna", "vendor": "Redis"}, "product": "redis", "vendor": "redis"}], "created": "2026-07-25T02:30:04.155302+00:00", "updated": "2026-08-07T01:45:05.276936+00:00", "vendors": ["redis", "redis$PRODUCT$redis"]}